Forms that accept attachments.
WHY IT IS RISKY
An upload form is a route into your server.
An executable file uploaded and then run gives an attacker control.
WHAT TO RESTRICT
Which file types are accepted Maximum file size Whether uploaded files can be executed
THE TYPE RESTRICTION
Allow only what you need: documents and images, typically.
Never allow executable or script file types.
CHECKING THE ACTUAL TYPE
Extension checking alone is insufficient. A file named as an image may not be one.
Good plugins verify the actual content.
PREVENTING EXECUTION
Uploaded files should be stored where scripts cannot run.
A rule preventing execution in the upload directory closes this route.
WHERE UPLOADS ARE STORED
If they land in public_html, anyone with the address can download them.
For anything sensitive, store outside public_html or serve through the site.
THE CV AND DOCUMENT CASE
Job applications and quote requests frequently include personal documents.
Those should not be publicly downloadable.
WHAT TO CHECK
Whether your upload directory is browsable.
